PEN-200 Buffer Overflow Fundamentals Practice Test 2 — 15 Questions

Question 1

Which of the following best describes the function of the EIP register in the context of a stack-based buffer overflow?

Accepted Answer

It points to the memory address of the next instruction to be executed.. The EIP (Extended Instruction Pointer) register holds the memory address of the next instruction the CPU should execute. In an exploit, the goal is to overwrite this register by corrupting the saved return address on the stack. When the function finishes, the CPU pops this controlled value into EIP, forcing the processor to jump to the attacker's shellcode, thus hijacking the control flow of the entire application.

Answer

It stores the current stack frame's base address.

Answer

It keeps track of the number of active threads.

Answer

It holds the results of arithmetic operations.

Question 2

Why are static memory addresses for 'JMP ESP' preferred over dynamic stack addresses?

Accepted Answer

Static addresses remain constant across different executions.. Stack addresses change during every execution of a program due to factors like system environment variables and memory allocation. If you use a hardcoded stack address in your exploit, it will likely be invalid the next time the program runs. A static JMP ESP address, found in a loaded DLL or the binary itself, remains constant, providing a reliable and stable redirect for your shellcode execution every time.

Answer

Static addresses are faster to access by the CPU.

Answer

Static addresses are less likely to contain bad characters.

Answer

Static addresses are protected by DEP and ASLR.

Question 3

What role does the 'padding' play in a buffer overflow payload structure?

Accepted Answer

It ensures the return address is correctly aligned for overwriting.. Padding is the data placed between the start of the buffer and the return address. Its purpose is to exactly fill the buffer space so that the subsequent bytes in the payload land precisely on the return address. Without correct padding, the return address would be overwritten by the wrong bytes, causing the program to jump to an unintended and invalid location, leading to a crash rather than code execution.

Answer

It acts as a NOP sled for the payload.

Answer

It prevents the stack from overflowing too quickly.

Answer

It is used to encode the shellcode against detection.

Question 4

Given the exhibit, why might using the address 0x00401020 to overwrite EIP be ineffective for shellcode execution?

Accepted Answer

The instruction does not redirect the CPU to the stack.. The instruction at 0x00401020 is a CALL [EAX], which does not transfer control to the stack where your shellcode resides. Instead, it attempts to call an address stored in the EAX register. Since you do not control EAX, this instruction will not lead to your shellcode. A successful exploit requires a direct jump to the stack pointer (JMP ESP) or a register you control, not a CALL instruction.

Answer

The memory address contains bad characters.

Answer

The address is located in the data segment.

Answer

The stack has already been corrupted by the padding.

Question 5

What is the primary purpose of an exploit payload in a buffer overflow context?

Accepted Answer

To execute arbitrary commands on the target system.. The exploit payload is the set of instructions (often shellcode) that you want the CPU to execute once you have successfully redirected the program's control flow. The goal is to perform an action, such as spawning a reverse shell or executing a command. The entire process of finding an offset and overwriting the return address is merely the delivery vehicle for this payload, which provides the desired post-exploitation access.

Answer

To increase the size of the target buffer.

Answer

To crash the application for a denial-of-service attack.

Answer

To bypass the authentication mechanism of the application.

Question 6

Which TWO of the following are common reasons for a buffer overflow exploit to fail even after the return address is correctly overwritten?

Accepted Answer

The presence of undocumented bad characters in the payload.. Exploits often fail due to environmental factors that were not accounted for during the development phase. Even with a perfect offset, the presence of hidden bad characters can truncate the shellcode before it reaches the stack. Additionally, security controls like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization) can prevent the shellcode from executing if the environment is locked down, rendering a simple stack-based overflow ineffective.

Answer

The use of a static JMP ESP address.

Answer

The pattern generator failed to reach the buffer.

Answer

The shellcode is too short for the buffer.

Question 7

When analyzing a stack buffer, what is the significance of the 'saved EBP' value?

Accepted Answer

It helps the program restore the previous stack frame.. The saved EBP is part of the standard function epilogue, which helps the program restore the stack frame of the calling function. In a buffer overflow, this value is overwritten immediately before the return address. While usually not the primary target for flow hijacking, it is a critical piece of the stack frame that, if corrupted, will likely cause the program to crash when it attempts to restore the stack frame after the function finishes.

Answer

It is the primary register for shellcode execution.

Answer

It is a security mechanism to prevent overflows.

Answer

It stores the base address of the shellcode.

Question 8

During a stack-based buffer overflow exploitation attempt in a Win32 environment, you notice that your shellcode execution fails because certain memory addresses contain null bytes (0x00). Which component of the exploit development process is primarily responsible for identifying and mitigating bad characters?

Accepted Answer

Sending a byte array from 0x00 to 0xFF into the vulnerable buffer and inspecting memory to see which bytes are altered or truncated.. Identifying bad characters is a critical step in buffer overflow development because application functions or memory copy routines may terminate prematurely upon encountering values like null bytes. During the discovery phase, testers systematically send all byte arrays to analyze how memory handles specific inputs, ensuring subsequent shellcode generation avoids breaking the exploit chain and successfully achieves remote code execution.

Answer

Generating a cyclic pattern using pattern_create.rb to determine the precise offset required to overwrite the saved instruction pointer.

Answer

Analyzing memory contents in a debugger to find a stable return-oriented programming gadget pointer.

Answer

Compiling the exploit script with Python to encode the payload using a standard XOR-based encoding scheme.

Question 9

While debugging a custom TCP server running on a Windows target, you send an overly long string of 'A' characters and notice that the application crashes, overwriting the EIP register with 0x41414141. What does this specific hex value indicate about the state of the debugger?

Accepted Answer

The instruction pointer has successfully been overwritten with user-controlled input consisting of the character 'A'.. The hexadecimal value 0x41 corresponds directly to the ASCII character 'A'. When the instruction pointer contains four of these bytes, it proves that the input buffer successfully overflowed the local stack frame and precisely replaced the saved return address, confirming vulnerability and providing exact control over the execution flow.

Answer

The application encountered an unhandled memory access violation due to a null pointer dereference in the heap management routines.

Answer

The operating system security controls detected a stack cookie mismatch and deliberately terminated the application process.

Answer

The CPU executed an illegal instruction opcode that triggered an exception within the kernel-mode driver framework.

Question 10

You have successfully found the exact offset to overwrite the EIP register and identified a reliable JMP ESP instruction inside an unProtected DLL. However, when your shellcode executes, the program immediately crashes with an access violation before launching the payload. Inspection reveals that the stack pointer (ESP) points directly to the beginning of your shellcode, but the memory page housing the stack lacks execution permissions. Which modern defense mechanism is preventing your exploit from succeeding?

Accepted Answer

Data Execution Prevention (DEP) configured as OptOut or OptIn across the operating system environment.. Data Execution Prevention marks memory regions such as the stack and heap as non-executable to prevent malicious code from running directly from those locations. When an exploit attempts to jump into shellcode residing on the stack, the CPU generates an access violation because execution permissions are explicitly denied on that memory page.

Answer

Control Flow Guard (CFG) validating indirect call targets against a pre-compiled bitmap of valid function entries.

Answer

Address Space Randomization relocating the base addresses of operating system libraries dynamically on every reboot.

Answer

Structured Exception Handling Overwrite Protection guarding exception handler chains from malicious pointer manipulation.

Question 11

During a stack-based buffer overflow exploit development exercise against a custom Windows application, an OSCP student successfully overwrites the instruction pointer (EIP) with the address of a JMP ESP instruction. However, upon triggering the vulnerability, the application immediately crashes with an access violation before executing the shellcode located directly after the return address. Which of the following is the most likely root cause of this execution failure?

Accepted Answer

Data Execution Prevention (DEP) is enabled on the target application, blocking CPU execution instructions from the non-executable stack memory region.. An access violation directly following an EIP overwrite usually indicates that the target memory address pointed to by ESP is non-executable due to Data Execution Prevention (DEP). Even though control flow successfully transfers via JMP ESP, modern operating systems enforce hardware-level NX/DEP protections, preventing shellcode execution on the stack unless bypassed through Return-Oriented Programming or valid OS API functions.

Answer

The bad characters array contained null bytes that truncated the shellcode payload before it could reach the return address offset.

Answer

The stack pointer (ESP) was offset too far forward, causing the processor to execute NOP sled instructions instead of the first shellcode instruction.

Answer

The chosen JMP ESP instruction address contained little-endian byte ordering that corrupted the stack frame alignment during the return operation.

Question 12

During exploitation of a stack-based buffer overflow on a 32-bit Windows application, you overwrite EIP with the address of a JMP ESP instruction, but the shellcode does not execute. You verify the JMP ESP address is correct and that the shellcode is in memory. Which of the following is the most likely cause?

Accepted Answer

The shellcode contains null bytes, which terminate the string copy and prevent the full shellcode from being placed on the stack.. Null bytes in shellcode are a frequent problem when exploiting buffer overflows in string-based functions. Functions like strcpy or sprintf treat null bytes as string terminators, so any null byte in the shellcode will cause the copy to stop prematurely. As a result, the shellcode on the stack will be incomplete, and even with a correct JMP ESP, execution will fail. Therefore, ensuring shellcode is free of null bytes or properly encoded is essential. This is a common pitfall in Windows exploit development.

Answer

The JMP ESP instruction address contains a null byte, which prevents it from being written correctly to EIP.

Answer

The shellcode is encoded, and the decoder stub is missing, so it cannot execute.

Answer

The JMP ESP instruction is located in a memory region with the DEP (Data Execution Prevention) flag set.

Question 13

You are fuzzing a Linux x86-64 network service and cause a segmentation fault. You run the binary under GDB and see that the instruction pointer is 0x41414141. However, the crash address is in a non-executable stack region. Which technique should you use to redirect execution to your shellcode?

Accepted Answer

Use a ret2libc attack to call system() with a pointer to "/bin/sh".. When the stack is non-executable, direct shellcode execution fails. The ret2libc technique bypasses this by reusing existing executable code, typically calling functions like system() with controlled arguments. This is a standard method taught in PEN-200 for defeating NX, provided you can locate the necessary addresses and gadgets.

Answer

Use a heap spray to place shellcode in a predictable location and jump to it.

Answer

Overwrite the return address with a pointer to the stack and rely on the NX bit being disabled.

Answer

Increase the size of the buffer to overwrite the saved return address with a stack address.

Question 14

You are analyzing a Windows 32-bit application that uses a fixed-size stack buffer and calls strcpy() without bounds checking. You want to determine the exact offset to overwrite the saved return address. Which tool or method is most appropriate for this task?

Accepted Answer

Use a debugger to send a unique cyclic pattern and inspect the value of EIP.. The most reliable way to find the exact offset is to send a unique cyclic pattern and observe which four bytes overwrite EIP. This directly maps input position to the return address. Tools like Mona.py automate this process. Static counting or random fuzzing are less precise and can be misleading.

Answer

Use a disassembler to count the number of bytes between the buffer and the return address.

Answer

Use a hex editor to modify the binary and insert a breakpoint at the return instruction.

Answer

Use a fuzzer to send random data and monitor for a crash, then guess the offset.

Question 15

You are developing an exploit for a Windows 32-bit application with a stack buffer overflow. You have identified a JMP ESP instruction at a static address. However, the application uses SafeSEH. Which statement is true regarding the use of JMP ESP in this scenario?

Accepted Answer

JMP ESP can still be used if the address is in a module not compiled with SafeSEH.. SafeSEH is a mitigation for SEH overwrites, not for return address overwrites. If you are overwriting the saved return address, you can still use a JMP ESP gadget from a module that is not SafeSEH-protected. The presence of SafeSEH does not prevent this technique, as it only validates exception handlers when an exception occurs.

Answer

SafeSEH encrypts the JMP ESP instruction, making it unusable.

Answer

You must use a POP POP RET sequence instead of JMP ESP to bypass SafeSEH.

Answer

JMP ESP will not work because SafeSEH validates all addresses on the stack, including the return address.